Re: ipc: BUG: sem_unlock unlocks non-locked lock

From	Davidlohr Bueso <dave@stgolabs.net>
Newsgroups	linux.kernel
Subject	Re: ipc: BUG: sem_unlock unlocks non-locked lock
Date	2016-12-18 17:40 +0100
Message-ID	<sPMFb-2zL-17@gated-at.bofh.it> (permalink)
References	<sOX9D-1Ii-1@gated-at.bofh.it> <sPMvv-2r2-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sun, 18 Dec 2016, Bueso wrote:

>On Fri, 16 Dec 2016, Dmitry Vyukov wrote:
>
>>[ BUG: bad unlock balance detected! ]
>>4.9.0+ #89 Not tainted
>
>Thanks for the report, I can reproduce the issue as of (which I obviously
>should have tested with lockdep):
>
>370b262c896 (ipc/sem: avoid idr tree lookup for interrupted semop)
>
>I need to think more about it this evening, but I believe the issue to be
>the potentially bogus locknum in the unlock path, as we are calling sem_lock
>without updating the variable. I'll send a patch after more testing. This
>fixes it for me:
>
>diff --git a/ipc/sem.c b/ipc/sem.c
>index e08b94851922..fba6139e7208 100644
>--- a/ipc/sem.c
>+++ b/ipc/sem.c
>@@ -1977,7 +1977,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
>		}
>
>		rcu_read_lock();
>-		sem_lock(sma, sops, nsops);
>+	        sem_lock(sma, sops, nsops);

*sigh*, that would be:
	         locknum = sem_lock(sma, sops, nsops);

Thread

ipc: BUG: sem_unlock unlocks non-locked lock Dmitry Vyukov <dvyukov@google.com> - 2016-12-16 10:40 +0100
  Re: ipc: BUG: sem_unlock unlocks non-locked lock Davidlohr Bueso <dave@stgolabs.net> - 2016-12-18 17:30 +0100
    Re: ipc: BUG: sem_unlock unlocks non-locked lock Davidlohr Bueso <dave@stgolabs.net> - 2016-12-18 17:40 +0100
      Re: ipc: BUG: sem_unlock unlocks non-locked lock Manfred Spraul <manfred@colorfullife.com> - 2016-12-18 19:40 +0100
        [PATCH v2] ipc/sem.c: fix incorrect sem_lock pairing Manfred Spraul <manfred@colorfullife.com> - 2016-12-20 07:40 +0100

csiph-web